pdnsutil accepts a as nsec3 salt

[aerique]

• Program: Authoritative
• Issue type: Bug report

Short description

According to @Habbie the salt for NSEC3PARAM should be either - or an even number of hex digits, but it also accepts a as salt and turns it into a0.

Environment

• Operating system: Linux / Docker
• Software version: 4.6.4 but @Habbie confirmed it also happens on master
• Software source: powerdns/pdns-auth-46 (Docker)

Steps to reproduce

pdns@6deb0af3f606:/$ pdnsutil set-nsec3 normal.example.com "1 0 0 -"
NSEC3 set, Done, please secure and rectify your zone (or reload it if you are using the bindbackend)

pdns@6deb0af3f606:/$ pdnsutil show-zone normal.example.com
This is a Native zone
Zone is not actively secured
Metadata items: 
	NSEC3PARAM	1 0 0 -
	SOA-EDIT-API	DEFAULT
No keys for zone 'normal.example.com'.

pdns@6deb0af3f606:/$ pdnsutil set-nsec3 normal.example.com "1 0 0 ab"
NSEC3 set, Done, please secure and rectify your zone (or reload it if you are using the bindbackend)

pdns@6deb0af3f606:/$ pdnsutil show-zone normal.example.com
This is a Native zone
Zone is not actively secured
Metadata items: 
	NSEC3PARAM	1 0 0 ab
	SOA-EDIT-API	DEFAULT
No keys for zone 'normal.example.com'.

pdns@6deb0af3f606:/$ pdnsutil set-nsec3 normal.example.com "1 0 0 a"
NSEC3 set, Done, please secure and rectify your zone (or reload it if you are using the bindbackend)

pdns@6deb0af3f606:/$ pdnsutil show-zone normal.example.com
This is a Native zone
Zone is not actively secured
Metadata items: 
	NSEC3PARAM	1 0 0 a0
	SOA-EDIT-API	DEFAULT
No keys for zone 'normal.example.com'.

Expected behaviour

pdnsutil set-nsec3 normal.example.com "1 0 0 a" should give an error that an even number of hex digits is expected

Actual behaviour

a got accepted as salt and converted to a0

Other information

I talked and confirmed this issue with @Habbie on corporate private messages.

[miodvallat]

Tentative fix in #14913.